[Pam-developers] pam_unix and login.defs

Tomas Mraz tmraz at redhat.com
Tue Feb 5 14:08:23 UTC 2013


On Tue, 2013-02-05 at 14:00 +0100, Thorsten Kukuk wrote: 
> Hi,
> 
> I find it very disturbing, that you need to manual maintain
> the used encryption hash in /etc/login.defs for shadow and
> as pam_unix.so argument. Since we have already two modules
> reading /etc/login.defs, I made a small change to pam_unix.so:
> 
> The default encryption hash is taken from /etc/login.defs and
> can be overwritten with the pam_unix.so argument. If there is no
> entry in /etc/login.defs and no argument DES is still the default.
> 
> So this change should be pretty backward compatible.
> 
> Any opinions? Most of the code is from the other PAM modules, maybe
> we should add the /etc/login.defs parsing functions to libpam itself
> sometimes.

This is great. I've always wanted to implement this but never got to
it. 

+      if (buf == NULL)
+        {
+          buflen = BUF_SIZE;
+          buf = malloc (buflen);
+        }
+      buf[0] = '\0';
There is possible NULL pointer dereference if malloc() fails.

+           pam_syslog(pamh, LOG_WARNING, "unrecognized ENCRYPTION_METHOD value [%s]", val);
The login.defs option is ENCRYPT_METHOD. You have the same typo in the pam_unix.8.xml.

You're also missing free(val); call in the _set_ctrl().

If you fix these it should be OK to commit.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb



More information about the Pam-developers mailing list